CentOS下逻辑卷的tmp安全设置,centostmp

CentOS下逻辑卷的tmp安全设置,centostmp

Centos默认安装无指定分区的时候，逻辑卷没有独立的/tmp 容易造成安全隐患，/dev/shm也是隐患之一

#dd一个1G的文件，文件/.tmpfs

ddif=/dev/zeroof=/.tmpfsbs=1Mcount=1000

#创建文件系统

mke2fs -j /.tmpfs

####################

mke2fs 1.41.12 (17-May-2010)

/.tmpfsisnotablockspecialdevice.

Proceedanyway? (y,n)y

Filesystemlabel=

OStype: Linux

Blocksize=4096(log=2)

Fragmentsize=4096(log=2)

Stride=0blocks, Stripewidth=0blocks

64000inodes, 256000blocks

12800blocks(5.00%)reservedforthesuperuser

Firstdatablock=0

Maximumfilesystemblocks=264241152

8blockgroups

32768blockspergroup, 32768fragmentspergroup

8000inodespergroup

Superblockbackupsstoredonblocks:

32768, 98304, 163840, 229376

Writinginodetables: done

Creatingjournal(4096blocks): done

Writingsuperblocksandfilesystemaccountinginformation: done

Thisfilesystemwillbeautomaticallycheckedevery32mountsor

180days, whichevercomesfirst. Usetune2fs -cor -itooverride.

####################

#复制文件

cp -av /tmp /tmp.old

#挂载之前dd的文件

mount -oloop,noexec,nosuid,rw /.tmpfs /tmp

#赋默认/tmp的权限

chmod1777 /tmp

#把刚复制出去的文件移回来

mv -f /tmp.old/* /tmp/

#删除文件夹

rm -rf /tmp.old

#修改/etc/fstab 使它重启后自动挂载

/.tmpfs /tmp ext3 loop,nosuid,noexec,rw 0 0

#软链接/var/tmp到/tmp

mv /var/tmp /var/tmp_bak

ln -s /tmp /var/tmp

cp -Rf /var/tmp_bak/* /var/tmp

rm -rf /var/tmp_bak/

#测试

#分别到/tmp与/dev/shm目录里，创建可执行文件，并给与777权限

[root@localhost /tmp]

# ls -lA /tmp/|grepx.sh

-rwxrwxrwx1rootroot22Jul2515:08x.sh

[root@localhost /tmp]

# cat /tmp/x.sh

#!/bin/bash

echotest

[root@localhost /tmp]

# /tmp/x.sh

-bash: /tmp/x.sh: Permissiondenied

[root@localhost /dev/shm]

# ls -lA |grep x.sh

-rwxrwxrwx1rootroot22Jul2515:08x.sh

[root@localhost /dev/shm]

# cat x.sh

#!/bin/bash

echotest

[root@localhost /dev/shm]

# /dev/shm/x.sh

-bash: /dev/shm/x.sh: Permissiondenied

#修改/etc/fstab 改变/dev/shm共享内存的nosuid与noexec值

tmpfs/dev/shmtmpfsdefaults,nosuid,noexec,rw00

mount -oremount /dev/shm/